What registrars support *.onion TLD as a Subject Alternative Name, and how does validation work?

I'm interested in obtaining a .onion TLD in my SAN name from a public CA.

Which Public CAs support .onion TLDs and what is the validation process like (e.g. Whois isn't available for ToR)

Update:

Although DigiCert is issuing .onion certificates for Facebook, they have not made a process available to the masses for such a function.